Skip to content
←Back to glossaryFinance

Flash loan attack

Attack technique specific to decentralized finance. It uses an uncollateralized loan, repaid within the same transaction, to manipulate prices and drain a protocol of more than a hundred million dollars in a single transaction.

Definition

In October 2021, Cream Finance lost 130 million dollars in a single transaction. The attacker borrowed 500 million DAI in a flash loan, manipulated the price of an illiquid collateral token the protocol relied on, then borrowed far more than the real collateral allowed. The whole thing fit in one Ethereum block, about twelve seconds. The flash loan started as a legitimate DeFi tool: you borrow an arbitrary amount with no collateral, provided you repay it within the same atomic transaction, otherwise everything is reverted. It serves arbitrage and instant refinancing. Turned around, it hands the borrower, for a few seconds, enough market power to skew the price oracle and drain the liquidity pools. The attacker never commits capital of their own, every step reverts if the transaction fails, and the flaw usually sits in protocol design rather than in malicious code. DeFi covers struggle to classify the loss: smart-contract bug, market manipulation, or use of a feature open to everyone? The classification decides the cover.

Its 5 cross-references, woven across the glossary's 18 categories
Flash loan attack: Finance glossary illustration, AlgoPolis
Example

On October 27, 2021, the Cream Finance attacker borrows 500 million DAI in a flash loan from MakerDAO and over 500,000 ETH from Aave, deposits them with Cream and into Yearn's yUSD vault, the illiquid collateral token Cream accepted, then inflates the value of the yUSD share by a plain direct transfer to the vault, whose price Cream read as its oracle. The inflated collateral lets him borrow 130 million dollars he will never repay, all within one Ethereum block, approximately twelve seconds. It was the protocol's third hack of 2021, after 37.5 million in February and 18.8 million in August. No existing DeFi insurance covers the full loss.

Read next
FinanceSmart contractA computer program inscribed on a blockchain whose conditional logic automatically executes payments or transfers as soon as a predefined condition is met, without human intervention.Read the entry →AIOracle (parametric insurance)An external data source whose reading is binding for triggering a parametric payout. Its reliability becomes the contract's weak point.Read the entry →CyberRace conditionSoftware vulnerability where a program's behavior depends on the unintended ordering or timing of concurrent events. An attacker can exploit it to change system state between a check and its use.Read the entry →
Sources
  • Halborn, "Explained: The Cream Finance Hack (October 2021)"; Immunefi, "Hack Analysis: Cream Finance, Oct 2021" (over 130 million dollars in one transaction)
  • Immunefi, "Hack Analysis: Cream Finance, Oct 2021"; Halborn, "Explained: The Cream Finance Hack (October 2021)"
Related terms
Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.